146807 2015-07-09 14:01:58 -0700 SymbolTable::entryFor() should do a bounds check before indexing into the localToEntry vector. 2015-07-09 16:00:20 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 mark.lam mark.lam benjamin fpizlo ggaren keith_miller mmirman msaboff saam webkit-bug-importer oldest_to_newest 1108352 0 mark.lam 2015-07-09 14:01:58 -0700 When we capture an argument by name and we use "arguments", we put all of the arguments into the scope. But destructured arguments are put into the scope anonymously i.e. the SymbolTable knows that the scope offset is in use via SymbolTable::m_maxScopeOffset, but that ScopeOffset won't appear in SymbolTable::m_map. The SymbolTable's m_localToEntry vector is synthesized from its m_map, and will have a size which is based on the largest ScopeOffset in the m_map. If we have a scenario where the anonymous argument is at a higher ScopeOffset than all the named arguments, then the m_localsToEntry will not have an entry for it i.e. the m_localsToEntry vector will have a size that is <= the ScopeOffset of the anonymous argument. Hence, SymbolTable::entryFor() should ensure that the requested ScopeOffset is within the bounds of the m_localToEntry vector before indexing into it. 1108354 1 mark.lam 2015-07-09 14:03:31 -0700 <rdar://problem/20975495> 1108360 2 256516 mark.lam 2015-07-09 14:11:55 -0700 Created attachment 256516 the patch: testing is in progress. 1108371 3 256516 fpizlo 2015-07-09 14:21:00 -0700 Comment on attachment 256516 the patch: testing is in progress. View in context: https://bugs.webkit.org/attachment.cgi?id=256516&action=review > Source/JavaScriptCore/runtime/SymbolTable.cpp:133 > + auto toEntryVector = localToEntry(locker); This should be auto& 1108392 4 256527 mark.lam 2015-07-09 14:55:13 -0700 Created attachment 256527 patch 2: fixed bug found by Fil. 1108436 5 mark.lam 2015-07-09 16:00:20 -0700 All tests have passed with no new failures. EWS bot test failures appear to be due to pre-existing conditions. Patch landed in r186643: <http://trac.webkit.org/r186643>. 256516 2015-07-09 14:11:55 -0700 2015-07-09 14:55:13 -0700 the patch: testing is in progress. bug-146807.patch text/plain 2436 mark.lam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTg2NjA4KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI5IEBA CisyMDE1LTA3LTA5ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAgICAgICBT eW1ib2xUYWJsZTo6ZW50cnlGb3IoKSBzaG91bGQgZG8gYSBib3VuZHMgY2hlY2sgYmVmb3JlIGlu ZGV4aW5nIGludG8gdGhlIGxvY2FsVG9FbnRyeSB2ZWN0b3IuCisgICAgICAgIGh0dHBzOi8vYnVn cy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNDY4MDcKKworICAgICAgICBSZXZpZXdlZCBi eSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBXaGVuIHdlIGNhcHR1cmUgYW4gYXJndW1lbnQg YnkgbmFtZSBhbmQgd2UgdXNlICJhcmd1bWVudHMiLCB3ZSBwdXQgYWxsIG9mIHRoZQorICAgICAg ICBhcmd1bWVudHMgaW50byB0aGUgc2NvcGUuICBCdXQgZGVzdHJ1Y3R1cmVkIGFyZ3VtZW50cyBh cmUgcHV0IGludG8gdGhlIHNjb3BlCisgICAgICAgIGFub255bW91c2x5IGkuZS4gdGhlIFN5bWJv bFRhYmxlIGtub3dzIHRoYXQgdGhlIHNjb3BlIG9mZnNldCBpcyBpbiB1c2UgdmlhCisgICAgICAg IFN5bWJvbFRhYmxlOjptX21heFNjb3BlT2Zmc2V0LCBidXQgdGhhdCBTY29wZU9mZnNldCB3b24n dCBhcHBlYXIgaW4KKyAgICAgICAgU3ltYm9sVGFibGU6Om1fbWFwLgorCisgICAgICAgIFRoZSBT eW1ib2xUYWJsZSdzIG1fbG9jYWxUb0VudHJ5IHZlY3RvciBpcyBzeW50aGVzaXplZCBmcm9tIGl0 cyBtX21hcCwgYW5kIHdpbGwKKyAgICAgICAgaGF2ZSBhIHNpemUgd2hpY2ggaXMgYmFzZWQgb24g dGhlIGxhcmdlc3QgU2NvcGVPZmZzZXQgaW4gdGhlIG1fbWFwLiAgSWYgd2UgaGF2ZSBhCisgICAg ICAgIHNjZW5hcmlvIHdoZXJlIHRoZSBhbm9ueW1vdXMgYXJndW1lbnQgaXMgYXQgYSBoaWdoZXIg U2NvcGVPZmZzZXQgdGhhbiBhbGwgdGhlCisgICAgICAgIG5hbWVkIGFyZ3VtZW50cywgdGhlbiB0 aGUgbV9sb2NhbHNUb0VudHJ5IHZlY3RvciB3aWxsIG5vdCBoYXZlIGFuIGVudHJ5IGZvciBpdAor ICAgICAgICBpLmUuIHRoZSBtX2xvY2Fsc1RvRW50cnkgdmVjdG9yIHdpbGwgaGF2ZSBhIHNpemUg dGhhdCBpcyA8PSB0aGUgU2NvcGVPZmZzZXQgb2YKKyAgICAgICAgdGhlIGFub255bW91cyBhcmd1 bWVudC4KKworICAgICAgICBIZW5jZSwgU3ltYm9sVGFibGU6OmVudHJ5Rm9yKCkgc2hvdWxkIGVu c3VyZSB0aGF0IHRoZSByZXF1ZXN0ZWQgU2NvcGVPZmZzZXQgaXMKKyAgICAgICAgd2l0aGluIHRo ZSBib3VuZHMgb2YgdGhlIG1fbG9jYWxUb0VudHJ5IHZlY3RvciBiZWZvcmUgaW5kZXhpbmcgaW50 byBpdC4KKworICAgICAgICAqIHJ1bnRpbWUvU3ltYm9sVGFibGUuY3BwOgorICAgICAgICAoSlND OjpTeW1ib2xUYWJsZTo6ZW50cnlGb3IpOgorCiAyMDE1LTA3LTA5ICBNaWNoYWVsIFNhYm9mZiAg PG1zYWJvZmZAYXBwbGUuY29tPgogCiAgICAgICAgIFJFR1JFU1NJT04gKHIxODAyNDgpOiBSZXBy byBDcmFzaDogY29tLmFwcGxlLldlYktpdC5XZWJDb250ZW50IGF0IGNvbS5hcHBsZS5KYXZhU2Ny aXB0Q29yZTogSlNDOjpjcmVhdGVSYW5nZUVycm9yICsgMjAKSW5kZXg6IFNvdXJjZS9KYXZhU2Ny aXB0Q29yZS9ydW50aW1lL1N5bWJvbFRhYmxlLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2 YVNjcmlwdENvcmUvcnVudGltZS9TeW1ib2xUYWJsZS5jcHAJKHJldmlzaW9uIDE4NjYwNykKKysr IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL1N5bWJvbFRhYmxlLmNwcAkod29ya2luZyBj b3B5KQpAQCAtMTMwLDcgKzEzMCwxMCBAQCBjb25zdCBTeW1ib2xUYWJsZTo6TG9jYWxUb0VudHJ5 VmVjJiBTeW1iCiAKIFN5bWJvbFRhYmxlRW50cnkqIFN5bWJvbFRhYmxlOjplbnRyeUZvcihjb25z dCBDb25jdXJyZW50SklUTG9ja2VyJiBsb2NrZXIsIFNjb3BlT2Zmc2V0IG9mZnNldCkKIHsKLSAg ICByZXR1cm4gbG9jYWxUb0VudHJ5KGxvY2tlcilbb2Zmc2V0Lm9mZnNldCgpXTsKKyAgICBhdXRv IHRvRW50cnlWZWN0b3IgPSBsb2NhbFRvRW50cnkobG9ja2VyKTsKKyAgICBpZiAob2Zmc2V0Lm9m ZnNldCgpID49IHRvRW50cnlWZWN0b3Iuc2l6ZSgpKQorICAgICAgICByZXR1cm4gbnVsbHB0cjsK KyAgICByZXR1cm4gdG9FbnRyeVZlY3RvcltvZmZzZXQub2Zmc2V0KCldOwogfQogCiBTeW1ib2xU YWJsZSogU3ltYm9sVGFibGU6OmNsb25lU2NvcGVQYXJ0KFZNJiB2bSkK 256527 2015-07-09 14:55:13 -0700 2015-07-09 15:07:46 -0700 patch 2: fixed bug found by Fil. bug-146807.patch text/plain 2437 mark.lam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTg2NjA4KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI5IEBA CisyMDE1LTA3LTA5ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAgICAgICBT eW1ib2xUYWJsZTo6ZW50cnlGb3IoKSBzaG91bGQgZG8gYSBib3VuZHMgY2hlY2sgYmVmb3JlIGlu ZGV4aW5nIGludG8gdGhlIGxvY2FsVG9FbnRyeSB2ZWN0b3IuCisgICAgICAgIGh0dHBzOi8vYnVn cy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNDY4MDcKKworICAgICAgICBSZXZpZXdlZCBi eSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBXaGVuIHdlIGNhcHR1cmUgYW4gYXJndW1lbnQg YnkgbmFtZSBhbmQgd2UgdXNlICJhcmd1bWVudHMiLCB3ZSBwdXQgYWxsIG9mIHRoZQorICAgICAg ICBhcmd1bWVudHMgaW50byB0aGUgc2NvcGUuICBCdXQgZGVzdHJ1Y3R1cmVkIGFyZ3VtZW50cyBh cmUgcHV0IGludG8gdGhlIHNjb3BlCisgICAgICAgIGFub255bW91c2x5IGkuZS4gdGhlIFN5bWJv bFRhYmxlIGtub3dzIHRoYXQgdGhlIHNjb3BlIG9mZnNldCBpcyBpbiB1c2UgdmlhCisgICAgICAg IFN5bWJvbFRhYmxlOjptX21heFNjb3BlT2Zmc2V0LCBidXQgdGhhdCBTY29wZU9mZnNldCB3b24n dCBhcHBlYXIgaW4KKyAgICAgICAgU3ltYm9sVGFibGU6Om1fbWFwLgorCisgICAgICAgIFRoZSBT eW1ib2xUYWJsZSdzIG1fbG9jYWxUb0VudHJ5IHZlY3RvciBpcyBzeW50aGVzaXplZCBmcm9tIGl0 cyBtX21hcCwgYW5kIHdpbGwKKyAgICAgICAgaGF2ZSBhIHNpemUgd2hpY2ggaXMgYmFzZWQgb24g dGhlIGxhcmdlc3QgU2NvcGVPZmZzZXQgaW4gdGhlIG1fbWFwLiAgSWYgd2UgaGF2ZSBhCisgICAg ICAgIHNjZW5hcmlvIHdoZXJlIHRoZSBhbm9ueW1vdXMgYXJndW1lbnQgaXMgYXQgYSBoaWdoZXIg U2NvcGVPZmZzZXQgdGhhbiBhbGwgdGhlCisgICAgICAgIG5hbWVkIGFyZ3VtZW50cywgdGhlbiB0 aGUgbV9sb2NhbHNUb0VudHJ5IHZlY3RvciB3aWxsIG5vdCBoYXZlIGFuIGVudHJ5IGZvciBpdAor ICAgICAgICBpLmUuIHRoZSBtX2xvY2Fsc1RvRW50cnkgdmVjdG9yIHdpbGwgaGF2ZSBhIHNpemUg dGhhdCBpcyA8PSB0aGUgU2NvcGVPZmZzZXQgb2YKKyAgICAgICAgdGhlIGFub255bW91cyBhcmd1 bWVudC4KKworICAgICAgICBIZW5jZSwgU3ltYm9sVGFibGU6OmVudHJ5Rm9yKCkgc2hvdWxkIGVu c3VyZSB0aGF0IHRoZSByZXF1ZXN0ZWQgU2NvcGVPZmZzZXQgaXMKKyAgICAgICAgd2l0aGluIHRo ZSBib3VuZHMgb2YgdGhlIG1fbG9jYWxUb0VudHJ5IHZlY3RvciBiZWZvcmUgaW5kZXhpbmcgaW50 byBpdC4KKworICAgICAgICAqIHJ1bnRpbWUvU3ltYm9sVGFibGUuY3BwOgorICAgICAgICAoSlND OjpTeW1ib2xUYWJsZTo6ZW50cnlGb3IpOgorCiAyMDE1LTA3LTA5ICBNaWNoYWVsIFNhYm9mZiAg PG1zYWJvZmZAYXBwbGUuY29tPgogCiAgICAgICAgIFJFR1JFU1NJT04gKHIxODAyNDgpOiBSZXBy byBDcmFzaDogY29tLmFwcGxlLldlYktpdC5XZWJDb250ZW50IGF0IGNvbS5hcHBsZS5KYXZhU2Ny aXB0Q29yZTogSlNDOjpjcmVhdGVSYW5nZUVycm9yICsgMjAKSW5kZXg6IFNvdXJjZS9KYXZhU2Ny aXB0Q29yZS9ydW50aW1lL1N5bWJvbFRhYmxlLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2 YVNjcmlwdENvcmUvcnVudGltZS9TeW1ib2xUYWJsZS5jcHAJKHJldmlzaW9uIDE4NjYwNykKKysr IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL1N5bWJvbFRhYmxlLmNwcAkod29ya2luZyBj b3B5KQpAQCAtMTMwLDcgKzEzMCwxMCBAQCBjb25zdCBTeW1ib2xUYWJsZTo6TG9jYWxUb0VudHJ5 VmVjJiBTeW1iCiAKIFN5bWJvbFRhYmxlRW50cnkqIFN5bWJvbFRhYmxlOjplbnRyeUZvcihjb25z dCBDb25jdXJyZW50SklUTG9ja2VyJiBsb2NrZXIsIFNjb3BlT2Zmc2V0IG9mZnNldCkKIHsKLSAg ICByZXR1cm4gbG9jYWxUb0VudHJ5KGxvY2tlcilbb2Zmc2V0Lm9mZnNldCgpXTsKKyAgICBhdXRv JiB0b0VudHJ5VmVjdG9yID0gbG9jYWxUb0VudHJ5KGxvY2tlcik7CisgICAgaWYgKG9mZnNldC5v ZmZzZXQoKSA+PSB0b0VudHJ5VmVjdG9yLnNpemUoKSkKKyAgICAgICAgcmV0dXJuIG51bGxwdHI7 CisgICAgcmV0dXJuIHRvRW50cnlWZWN0b3Jbb2Zmc2V0Lm9mZnNldCgpXTsKIH0KIAogU3ltYm9s VGFibGUqIFN5bWJvbFRhYmxlOjpjbG9uZVNjb3BlUGFydChWTSYgdm0pCg==